ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0), ai.ancf.lmos:lmos-router-llm-in-spring-cloud-gateway-demo (0.1.0) +141 more potentially affected by CVE-2026-47825 via org.springframework.cloud:spring-cloud-gateway-server (>=4.0.0, <=4.3.4)

org.springframework.cloud:spring-cloud-gateway-server MAVEN version =4.0.0, =0.2.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =3.0.0, =1.0.0, =1.0.0, =2023.4.1.0, =1.0.5, =1.0.4, =jdk17-0.0.1, =3.0.0.1 and more Source cves: CVE-2026-47825 Source advisory:...

biz.eyebeam.mssc:mssc-public-bom (>=1.0.8, <=1.0.12), cn.crushes.cloud:crush-zipkin (>=2.4.5, <=2.5.0-ga) +515 more potentially affected by CVE-2026-41708 via org.springframework.cloud:spring-cloud-sleuth-instrumentation (>=3.0.0, <=3.1.11)

org.springframework.cloud:spring-cloud-sleuth-instrumentation MAVEN version =3.0.0, =1.0.8, =2.4.5, =0.0.2, =0.0.2, =1.0.0-release, =1.0.0-release, =1.0.0-release, =1.1.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-41708 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKCLOUD-17325634...

PT-2026-48620

Name of the Vulnerable Software and Affected Versions Spring Web Services versions 5.0.0 through 5.0.1 Spring Web Services versions 4.1.0 through 4.1.3 Spring Web Services versions 4.0.0 through 4.0.18 Spring Web Services versions 3.1.0 through 3.1.8 Description Integration paths between Spring W...

PT-2026-48625

Name of the Vulnerable Software and Affected Versions Spring for GraphQL versions 1.3.0 through 1.3.8 Spring for GraphQL versions 1.4.0 through 1.4.5 Spring for GraphQL versions 2.0.0 through 2.0.3 Description Applications are susceptible to unsafe deserialization when processing paginated GraphQ...

cn.net.pap:pap4j-boot3-starter-statemachine (>=0.0.1, <=0.0.4), guru.nicks.commons:statemachine-starter (>=100.260315.1, <=100.260611.0) +8 more potentially affected by CVE-2026-41862 via org.springframework.statemachine:spring-statemachine-data-common (>=4.0.0, <=4.0.1)

org.springframework.statemachine:spring-statemachine-data-common MAVEN version =4.0.0, =0.0.1, =100.260315.1, =4.0.0, =4.0.0, =4.0.0, =4.0.1 - org.springframework.statemachine:spring-statemachine-samples-datajpa 4.0.0 -...

CVE-2026-41001: Insecure Temporary File

Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts...

VMware Spring Boot security vulnerabilities

VMware Spring Boot is an open-source framework developed by the American company VMware. There are security vulnerabilities in versions 4.0.0 to 4.0.6, 3.5.0 to 3.5.14, 3.4.0 to 3.4.16, 3.3.0 to 3.3.19, and 2.7.0 to 2.7.33 of VMware Spring Boot. These vulnerabilities stem from the use of fixed...

PT-2026-48624

Name of the Vulnerable Software and Affected Versions Spring Boot versions 4.0.0 through 4.0.6 Spring Boot versions 3.5.0 through 3.5.14 Spring Boot versions 3.4.0 through 3.4.16 Spring Boot versions 3.3.0 through 3.3.19 Spring Boot versions 2.7.0 through 2.7.33 Description The...

CVE-2026-40992: Improper Certificate Validation

Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4...

PT-2026-80264

Spring Boot's Mail auto-configuration does not enable hostname verification. Applications that set the relevant JavaMail property, such as spring.mail.properties.mail.smtp.ssl.checkserveridentity=true, are not affected. Affected versions: Spring Boot 4.0.0 through 4.0.6; 3.5.0 through 3.5.14; 3.4...

PT-2026-80277

Spring Boot's ArtemisEmbeddedConfigurationFactory uses a fixed, static path for the embedded Artemis message broker's data directory when no explicit path is configured. A local attacker on the same host can pre-create this predictable directory or place a symlink before the application starts...

VMware Spring Boot Trust Management Vulnerability

VMware Spring Boot is an open-source framework developed by the American company VMware. There are security vulnerabilities related to trust management in versions of VMware Spring Boot 4.0.0 to 4.0.6, 3.5.0 to 3.5.14, and 3.4.0 to 3.4.16. These vulnerabilities stem from the automatic email...

Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory

A flaw was found in Spring Boot. A local attacker on the same host as the application may be able to take control of the ApplicationTemp directory due to predictable temporary directory handling. When the server.servlet.session.persistent setting is enabled and the attack persists across...

Spring Boot: Spring Boot: Weak pseudo-random number generation can lead to information disclosure.

A flaw was found in Spring Boot. The $random.value property source utilizes a weak pseudo-random number generator PRNG, meaning the values it produces are not sufficiently random for use as cryptographic secrets. An attacker could potentially predict these values, which may lead to information...

Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path

A flaw was found in Spring Boot. This vulnerability, an authentication bypass, occurs when an application endpoint requiring authentication is declared under a specific path already configured for a Health Group additional path. A remote attacker could exploit this to bypass authentication,...

Spring Boot: Spring Boot: Remote code execution via timing attack in DevTools remote secret comparison

A flaw was found in Spring Boot. An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about a remote secret. In extreme circumstances, this could allow the attacker to determine the secret and upload changed classes, leading to...

Important: Red Hat Security Advisory: HawtIO 4.4.0 for Red Hat build of Apache Camel 4 Release and security update.

HawtIO 4.4.0 for Red Hat build of Apache Camel 4 GA Release is now available. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products. Red Hat Product Security has rated this update ...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview org.springframework.security:spring-security-saml2-service-provider is a security component for the Spring Framework. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification in the REDIRECT binding. An attacker can exhaust system...

ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0.ee-20260424025040, <=1.0.0-20260628114628), com.eurodyn.qlack.fuse:qlack-fuse-aaa (>=3.9.8, <=3.9.9) +116 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=6.0.8, <=6.5.10)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.0.8, =1.0.0.ee-20260424025040, =3.9.8, =1.6.0, =11.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =dce37d6e6c310e0d86c4f0d73f8846b8ef2f4432, =1.0.6, =2026.0-19, =2026.0-19, =2026.1.3 and more Source cves:...

com.erudika:para-server (>=1.52.0, <=1.54.7), io.orqueio.bpm.springboot:orqueio-bpm-spring-boot-starter-security (>=2.0.1, <=2.0.7) +3 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=7.0.0-m1, <=7.0.5)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =7.0.0-m1, =1.52.0, =2.0.1, =4.0.0-m1, =4.0.0-m1, =4.0.0-rc1, =4.0.6 Source cves: CVE-2026-40988 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633...